Privacy Policy: corpuls auryx App in combination with c-med° alpha/corpuls auryx

Other language versions of this privacy policy:
Danish / Dansk
Dutch / Nederlands
Finnish / Suomi
French / Français
Italian / Italiano
Norwegian / Norsk
Polish / Polski
Spanish / Español
Swedish / Svensk

cosinuss° takes the protection of your personal data very seriously. We only collect and store data that is necessary for the purpose of the products and services described here. We treat collected data confidentially and in accordance with the statutory data protection regulations.

This privacy policy applies to the iPhone and Android corpuls auryx Apps (hereinafter called “app” or “corpuls auryx App”), which can be used in combination with the c-med° alpha and the corpuls auryx in-ear vital signs sensors (hereinafter called “sensor”).

The c-med° alpha is an ear-worn class IIa medical device that continuously monitors vital signs inside the outer ear canal. It collects human biosignals, calculates vital signs and transmits the values in real time to the corpuls auryx App.

The corpuls auryx is an ear-worn class IIb medical device that continuously monitors vital signs inside the outer ear canal and can be used on critical patients in emergency settings. It collects human biosignals, calculates vital signs and transmits the values in real time to the corpuls auryx App.

This declaration explains the type, purpose and scope of data collection in the context of app use.

What data is collected when using c-med° alpha/corpuls auryx
with the corpuls auryx App?

The c-med° alpha/corpuls auryx in-ear sensors generate and send data to the corpuls auryx App via Bluetooth Low Energy, but do not store any data themselves. If there is no Bluetooth connection for a short time, the vital parameter data recorded and calculated by the sensor will be lost at that time. The app displays and saves the received data and allows you to export and share it.

A measurement can be stopped at any time by exiting the corpuls auryx app or turning off the sensor.

The following data is generated when using c-med° alpha/corpuls auryx with the corpuls auryx App:

Data generated by c-med° alpha/corpuls auryx and corpuls auryx App

Data	Description	Storage
Metadata
c-med° alpha/corpuls auryx (with associated firmware)
MAC Address	Media-Access-Control address	Storage in Android app & on server.
Unique Device Identification	Identification number	Storage in app & on server.
Firmware Version	Version number of the software running on the sensor.	Storage in app & on server.
Bluetooth Device Name	Bluetooth name of the sensor.	No storage.
Sensor Size	Size of the sensor head.	Storage in app & on server.
corpuls auryx App
corpuls auryx App Version	Version number of the app.	Storage in app.
corpuls auryx App UUID	Unique identifier of the app of the format „xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx“	Storage in app.
Logged data
corpuls auryx App
Device Error	Device Errors messages from c-med° alpha/corpuls auryx.	Storage in app & on server.
Recording Start Time	Start time of a recording.	Storage in app.
Recording End Time	End time of a recording.	Storage in app.
Encounter ID	Unique identifier of the recording with the format: „XXXXXX.XXXXXXXXX“	Storage in app & on server.
Relation	Sensor-patient relations.	Storage in app.
Status Code	In-progress, Finished, Cancelled, Entered-in-error	Storage in app.
Class Code	EMER → Emergency	Storage in app.
Owner	Related username of the °Health Web account.	Storage in app.
Alarm Logs	ID, alarm type, when datetime	Storage in app.
Data generated
Quality indicators
Quality index	Index to assess the reliability of the pulse measurement, sensor fit.	Storage in app.
Perfusion index	An indicator of the reliability of oxygen saturation.	Storage in app.
Vital signs (calculated by c-med° alpha/corpuls auryx)
Body temperature	Body temperature (°C or °F)	Storage in app.
Pulse rate	Beats per minute (bpm)	Storage in app.
SpO2	Arterial oxygen saturation of the blood (%)	Storage in app.
Derived parameters
PPG med	Photoplethysmogram filtered and resampled.	Storage in app.
Acc_deviation	Indicator for accelerations.	Storage in app.
Battery	Battery states of the sensor.	Storage in app.
Battery ECG	Battery charge percentage of ECG.	Storage in app.
Perfusion index tech	Technical perfusion index.	Storage in app.
BLE packet counter	Package counter to sort the packages correctly.	Storage in app.
Phi	Azimuthal angle (-180° to 180°)	Storage in app.
RSSI	Received Signal Strength Indicator	Storage in app.
Theta	Polar angle (0° to 180°)	Storage in app.

The device information of the c-med° alpha/corpuls auryx is stored both in the app and on the cosinuss° server located in Germany in order to track the version numbers and update & error history of the devices at any time (regulatory purposes) as well as to be able to provide qualified support. With the help of the stored device information, a better user experience is guaranteed and this information is also necessary to be able to inform the user about an update for his c-med° alpha/corpuls auryx device. The duration of storage is aligned with the requirements of applicable medical devices laws.

The corpuls auryx App serves as an extended display of the c-med° alpha/corpuls auryx in-ear sensors. The app stores the calculated and transmitted vital parameter data of the user on the mobile device it is operating on. cosinuss° has no access to the data. It is solely your decision if and when this data is deleted from the mobile device. If you want to access the stored data, you can export it via the app as a CSV file.

Note: Patient-sensor relations are not included in the export file.

Optional user input in the corpuls auryx App

Data	Description	Storage
Optional user input
corpuls auryx app
Patient first name	First name of patient	Storage in app only.
Patient last name	Last name of patient	Storage in app only.
Patient birthday	Date of birth of patient	Storage in app only.
Sex	Sex	Storage in app only.

Optional user data input can be stored in the app to improve data interpretation. This information, however, will not be exported in the CSV file.

Please note! Cosinuss GmbH has no access to your data via the corpuls auryx App and does not transmit any data to third parties without your prior consent.

Please note! As a user, please protect the display of your data on your local receiving device against unauthorized access on your own responsibility. Please only use trusted and secured devices and services.

Connecting with cosinuss° Health Web application

Starting with version 1.3.209 of the corpuls auryx App (formerly °Health App), the user has the additional possibility to connect the cosinuss° Health Web account and transmit recorded data to the underlying °Health server. This functionality enables access to the data from anywhere and creates new interfacing possibilities. Using this functionality, the following data from the corpuls auryx App will be transmitted to the °Health Web server.

Data transmitted to °Health Web server if user connects to the °Health Web account:

Data	Data Type	Description
Sensor Device (c-med° alpha/corpuls auryx)
Serial of in-ear sensor	String (6 characters)	Unique sensor serial number
Metadata
Encounter ID	UUID string (16 characters)	Unique identifier of the recording with the format: „XXXXXX.XXXXXXXXX“
Recording Start Time	Timestamp	Start time of the recording.
Recording End Time	Timestamp	End time of the recording.
Status Code	String	In-progress, Finished, Cancelled, Entered-in-error
Class Code	String	EMER → Emergency
corpuls auryx App UUID	UUID string (36 characters)	Unique identifier of the app of the format „xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx“
Owner	String	Related username of the °Health Web account.
Data Generated
Quality indicators
Perfusion IR	Float16	Pulse strength as a percentage.
Quality	Uint8	Sensor fit and signal quality.
Vital Signs
Body temperature	Float16	Infrared thermometer temperature
Pulse Rate	Uint8	Pulse rate in beats per minute (bpm).
SpO2	Uint8	Blood oxygen saturation (SpO₂)
ECG channel 1	Binary (32 bit), 200 Hz	Raw Electrocardiogram of channel 1
ECG channel 2	Binary (32 bit), 200 Hz	Raw Electrocardiogram of channel 2
ECG channel 3	Binary (32 bit), 200 Hz	Raw Electrocardiogram of channel 3
Derived Data
PPG med	Binary (32 bit), 40 Hz	Photoplethysmogram filtered and resampled.
ACC_deviation	Float32	Indicator for accelerations.
Battery	Uint8	Battery states of the sensor.
Battery ECG	Uint8	Battery charge percentage
Perfusion IR technical	Float16	Technical perfusion index.
BLE packet counter	Uint32	Package counter to sort the packages correctly.
Phi	Float32	Azimuthal angle (-180° to 180°)
RSSI	Int8	Received Signal Strength Indicator
Theta	Float32	Polar angle (0° to 180°)

Processing inside °Health Web

cosinuss° generates, processes and stores the data listed above in order to fulfil the purpose defined with each Data controller individually. If not explicitly agreed upon differently, cosinuss° will hand back and delete personal data when data processing under the Principal Agreement with the Data controller ceases or at the written request of the Data Controller.

cosinuss° ensures that only employees, sub-processors, business partners, external consultants and temporary workers etc who need to know have access to the personal data covered by the Data Processing Agreement and that they all are bound by professional confidentiality or are subject to a relevant statutory duty of confidentiality.

If cosinuss° is involved in the sale or transfer of some or all of its assets, personal data may be disclosed to the acquiring organization but only to an extent permitted by law. In this process the acquiring organization will be directed to agree to protect the privacy of your Personal data in a manner consistent with this declaration and applicable law.

Security °Health Web

cosinuss° uses commercially reasonable and appropriate physical, electronic, and managerial procedures to safeguard and secure the Personal data collected. Whenever health data is transmitted, it is encrypted. So even if the transmission protocol is accessed by an unauthorized third party, they can’t use the transmitted information. However, cosinuss° can’t fully eliminate security and/or privacy risks associated with Personal data created, stored or transferred using the internet and internet technologies. cosinuss°, as the Data processor, shall not be liable for any breach, unauthorized disclosure or unlawful use of Personal data or Health data that was, at the time of the breach, under the control of the Data processor.

Cryptographic techniques

Authentification

cosinuss° only collects and processes data of pseudonymized Data subjects and limits access to this data to the authorized persons who need to know and are bound to confidentiality.

Bluetooth

The Bluetooth LE data transmission uses traffic encryption. Additionally, cosinuss° offers a 1-1 pairing mode including authentication.

Hypertext Transfer Protocol Secure (HTTPS)

The Hypertext Transfer Protocol Secure is using the latest TLS Certificates to ensure secure communication in the World Wide Web. Also, the Advanced Encryption Standard (AES) and Block Ciphers are protecting the data transmission true to the highest classification. HTTPS is used in the WebInterface as well as between the communication gateway device/lab app and server.

Server Location °Health Web

Servers are located in two different data centers (Nuremberg & Falkenstein / Germany) from Hetzner Online GmbH.

Certification

• Hetzner Online GmbH has its business address at Industriestraße 25, 91710 Gunzenhausen, Germany and is certified according to DIN ISO/IEC 27001
• cosinuss° has a data processing agreement with Hetzner, according to the Art. 28 GDPR

Data Protection

• Redundant data storage at different data centers
• Full encryption of data at rest
• Video-monitored high security fence around the entire data center park
• Access only via access control terminals with transponder or access cards
• State-of-the-art surveillance cameras for 24/7 monitoring of access roads, entrances, Security gates and server rooms
• Modern early fire detection system with direct connection to the local fire department

Availability of Services

• Redundant web services running at different data centers
• Emergency power supply
• Redundant USV systems
• Battery operation: approx. 15 minutes
• Temperature monitoring of room air and in server/distribution cabinets
• DDOS protection
• Suppressed botnet communication

Data Protection Impact Assessment (DPIA)

A Data Protection Impact Assessment (DPIA) is required under the GDPR any time you begin a new project that is likely to involve “a high risk” to other people’s personal information. With Remote Vital sign monitoring this may be the case if the type of processing in particular is:

• Using new technologies
• Tracking people‘s behaviour
• Processing data concerning health
• Processing used for automatic decisions
• Processing children‘s data

cosinuss° recommends preparing for a DPIA before beginning any data processing activity. Ideally, the DPIA should be conducted before and during the planning stages of a new project. If you have a Data Protection Officer you must consult with that person, and any other key stakeholders involved in the project, throughout the course of the DPIA. It should contain the following elements:

• A systematic description of the envisaged processing operations and the purposes of the processing, including, where applicable, the legitimate interest pursued by the controller.
• An assessment of the necessity and proportionality of the processing operations in relation to the purposes.
• An assessment of the risks to the rights and freedoms of data subjects.

Data collected on the basis of granted access rights

Location data & Bluetooth

In order for you to connect your c-med° alpha to your receiving device via Bluetooth Low Energy, your operating system (usually the case with Android) will require access to your location data. The °Health App and Cosinuss GmbH have no influence on this access and do not obtain access to your location data.

Cosinuss GmbH also points out that data transmission via Bluetooth involves security risks. Complete protection of data against access by third parties is not possible.

Error analysis

Upon your optional consent, in case of a technical error, you may authorize a technical event log (log file) to be sent to Firebase Crashlytics for a specific error event. The log file is also provided to cosinuss° and helps the development team to know about errors and to find and fix the cause of them. In the log file, device information of the c-med° alpha and your mobile device, °Health App version information and settings of your operating system at the time of the error are sent along. Recorded vital signs will be explicitly not sent along. Firebase Crashlytics is operated by Google. The respective privacy policies can be found at https://privacy.google.com/ and https://firebase.google.com/support/privacy/. Submitted data may be retained in Firebase’s processing systems for an extended period of time.

When logging errors, cosinuss° explicitly only uses the Crashlytics and no other Firebase services.

Location of the cosinuss° servers

The cosinuss° servers are provided and hosted by Hetzner Online GmbH, located at Industriestrasse 25, 91710 Gunzenhausen. A corresponding data processing agreement exists between the parties. The servers are located in Nuremberg and Falkenstein (Vogtl.) in Germany. Hetzner Online GmbH is DIN ISO/IEC 27001 certified and thus offers the legally required protection for personal data.

Further services of Cosinuss GmbH

Apart from the use of the c-med° alpha and the °Health App, you will come into contact with external links and websites, e.g. when making purchases, customer service inquiries or other services of Cosinuss GmbH.

The European General Data Protection Regulation (“GDPR”) applies to all pages and services of Cosinuss GmbH. Please refer to the data protection information on the respective websites.

Information, deletion, blocking

You have the right at any time to free information about your stored data, its origin and recipient and the purpose of data processing, as well as the right to correct, block or delete this data.

For this purpose, as well as for further questions on the subject of data, you can contact the responsible office at cosinuss° at any time using the contact details provided.

Right of appeal to the competent supervisory authority

We would like to point out that you have the right to lodge a complaint with the responsible supervisory authority in the event of data protection violations.

You can contact us at:
dataprivacy@cosinuss.com

or contact our external data protection officer:

IITR Datenschutz GmbH

Dr. Sebastian Kraska

Marienplatz 2

80331 Munich

Germany

Tel: +49 89 189 173 60
Email: email@iitr.de

The supervisory authority for data protection issues is the state data protection commissioner of the federal state in which cosinuss° has its headquarters. A list of data protection officers and their contact details can be found in the following link: https://www.bfdi.bund.de/EN/Home/home_node.html

Amendment of this privacy policy

We reserve the right to change this privacy policy in compliance with the law and to request your consent again.

Responsible entity

The “responsible entity” is the entity that collects, processes or uses your personal data. The responsible entity for data processing within the scope of this app is:

Cosinuss GmbH,

Kistlerhofstraße 60,

81379 Munich,

Germany,

Phone.: +49 (0)89 740 418 32

E-Mail: dataprivacy@cosinuss.com

Governing Law

This Data privacy policy shall be governed by German or similar national law.

Document last changed in July 2026.

---

 

Danish/Dansk

Privatlivspolitik: corpuls auryx App i kombination med c-med° alpha/corpuls auryx

Dokumentet sidst ændret i juli 2026.

---

Dutch/Nederlands

Privacybeleid: corpuls auryx App in combinatie met c-med° alpha/corpuls auryx

Dit document is voor het laatst gewijzigd in juli 2026.

---

Finnish/Suomi

Tietosuojaseloste: corpuls auryx -sovellus yhdessä c-med° alpha/corpuls auryx -laitteen kanssa

Asiakirjaa viimeksi muutettu heinäkuussa 2026.

---

French / Français

Politique de confidentialité: Application corpuls auryx en association avec c-med° alpha/corpuls auryx

Document modifié pour la dernière fois en juillet 2026.

---

Italian/Italiano

Informativa sulla privacy: corpuls auryx App in combinazione con c-med° alpha/corpuls auryx

Documento modificato l’ultima volta a luglio 2026.

---

Norwegian/Norsk

Personvernerklæring: corpuls auryx App i kombinasjon med c-med° alpha/corpuls auryx

Dokumentet sist endret i juli 2026.

---

Polish / Polski

Polityka prywatności: Aplikacja corpuls auryx w połączeniu z c-med° alpha/corpuls auryx

Dokument ostatnio zmieniony w lipcu 2026 r.

---

Spanish/Espanol

Política de privacidad: Aplicación corpuls auryx en combinación con c-med° alpha/corpuls auryx

Documento modificado por última vez en julio de 2026.

---

Swedish/Svensk

Integritetspolicy: corpuls auryx App i kombination med c-med° alpha/corpuls auryx

Dokumentet senast ändrat i juli 2026.